SUSE-SU-2016:1175-1

    Dashboard / Vulnerabilities / SUSE-SU-2016:1175-1

    SUSE-SU-2016:1175-1

    Published: 28 Apr 2016Last Modified: 4 Feb 2026

    Summary: Security update for ntp

    Details: ntp was updated to version 4.2.8p6 to fix 12 security issues. These security issues were fixed: - CVE-2015-8158: Fixed potential infinite loop in ntpq (bsc#962966). - CVE-2015-8138: Zero Origin Timestamp Bypass (bsc#963002). - CVE-2015-7979: Off-path Denial of Service (DoS) attack on authenticated broadcast mode (bsc#962784). - CVE-2015-7978: Stack exhaustion in recursive traversal of restriction list (bsc#963000). - CVE-2015-7977: reslist NULL pointer dereference (bsc#962970). - CVE-2015-7976: ntpq saveconfig command allows dangerous characters in filenames (bsc#962802). - CVE-2015-7975: nextvar() missing length check (bsc#962988). - CVE-2015-7974: Skeleton Key: Missing key check allows impersonation between authenticated peers (bsc#962960). - CVE-2015-7973: Replay attack on authenticated broadcast mode (bsc#962995). - CVE-2015-8140: ntpq vulnerable to replay attacks (bsc#962994). - CVE-2015-8139: Origin Leak: ntpq and ntpdc, disclose origin (bsc#962997). - CVE-2015-5300: MITM attacker could have forced ntpd to make a step larger than the panic threshold (bsc#951629). These non-security issues were fixed: - fate#320758 bsc#975981: Enable compile-time support for MS-SNTP (--enable-ntp-signd). This replaces the w32 patches in 4.2.4 that added the authreg directive. - bsc#962318: Call /usr/sbin/sntp with full path to synchronize in start-ntpd. When run as cron job, /usr/sbin/ is not in the path, which caused the synchronization to fail. - bsc#782060: Speedup ntpq. - bsc#916617: Add /var/db/ntp-kod. - bsc#956773: Add ntp-ENOBUFS.patch to limit a warning that might happen quite a lot on loaded systems. - bsc#951559,bsc#975496: Fix the TZ offset output of sntp during DST. - Add ntp-fork.patch and build with threads disabled to allow name resolution even when running chrooted. - bsc#784760: Remove local clock from default configuration

    References: https://www.suse.com/support/update/announcement/2016/suse-su-20161175-1/, https://bugzilla.suse.com/782060, https://bugzilla.suse.com/784760, https://bugzilla.suse.com/916617, https://bugzilla.suse.com/951559, https://bugzilla.suse.com/951629, https://bugzilla.suse.com/956773, https://bugzilla.suse.com/962318, https://bugzilla.suse.com/962784, https://bugzilla.suse.com/962802, https://bugzilla.suse.com/962960, https://bugzilla.suse.com/962966, https://bugzilla.suse.com/962970, https://bugzilla.suse.com/962988, https://bugzilla.suse.com/962994, https://bugzilla.suse.com/962995, https://bugzilla.suse.com/962997, https://bugzilla.suse.com/963000, https://bugzilla.suse.com/963002, https://bugzilla.suse.com/975496, https://bugzilla.suse.com/975981, https://www.suse.com/security/cve/CVE-2015-5300, https://www.suse.com/security/cve/CVE-2015-7973, https://www.suse.com/security/cve/CVE-2015-7974, https://www.suse.com/security/cve/CVE-2015-7975, https://www.suse.com/security/cve/CVE-2015-7976, https://www.suse.com/security/cve/CVE-2015-7977, https://www.suse.com/security/cve/CVE-2015-7978, https://www.suse.com/security/cve/CVE-2015-7979, https://www.suse.com/security/cve/CVE-2015-8138, https://www.suse.com/security/cve/CVE-2015-8139, https://www.suse.com/security/cve/CVE-2015-8140, https://www.suse.com/security/cve/CVE-2015-8158

    Affected packages

    Package

    Name: ntp

    Purl: pkg:rpm/suse/ntp&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP4

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -4.2.8p6-8.2

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    SUSE-SU-2016:1175-1 | CVE-DB